181–190 of 267 posts
The site also uses a Let's Encrypt certificate, which seems strange. This appears to be a massive, coordinated and not very well-executed effort to promote this Wero service. My guess is that the sites were all build by the same advertising agency.
Earlier quoted context omitted.
The company we use for our yearly mandated training has a cybersecurity "class" which tells you not to click links in emails (which is good advice!). Three guesses on how you log in to the service.
> which tells you not to click links in emails (which is good advice!). Hardly. The company shouldn't have XSRF-vulnerable software, if your browser is vulnerable you have bigger problems and what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. But of course there's an internal "phising test" that penalizes you for clicking on links... links that have been obfuscated…
Then why even click on it in the first place (and risk your email address getting flagged as active in some illicit database?)
Earlier quoted context omitted.
Per Chesterton's Fence, isn't this the right course of action for any individual who is unsure of why the practice was started? https://www.lesswrong.com/w/chesterton-s-fence
I like that fence, but I consider the best course of action to be going and finding out why the thing is done the eay it is, even if it necessitates careful investigation.
"We'd like to confirm this wire. We just need some details."
"Okay, I am me, that's true. But I should probably call Chase back for this right? This is textbook scam stuff. What do I tell them to get to you as fast as possible."
"All right, sir. That's fine. Let me just make a note on the account. You should be able to find the phone number on the website"
And then I usually just find my way. It's funny, but you kind of have to be disciplined.
Earlier quoted context omitted.
That is a really bad idea. That's letting anyone who phones you prove to the bank that they are you. You should only reveal an MFA code to someone that you have called, knowing that it is the right person.
Walk me through the chain you’re thinking of. I want to understand it better. If you’re thinking that - for example - someone is attempting to log into my account online and simultaneously call me pretending to be the bank. They are presented with an MFA check and tell me they initiated it. I give it to them unwittingly, and note they are in. My understanding is that isn’t possible here, because this “MFA check” is d…
My bank replaced their phone authentication with something that asks you to speak a phrase (the same one every time) and tries to recognise your voice. Luckily that's completely bulletproof, there's no way it can be forged :-/
User facing tech and marketing practices at banks are the worst. Every Indian bank login form I've ever had to use is - hostile to password managers. - You cannot copy paste passwords. - Client side password hashing - Stupid requirements like the password cannot have more than 15 characters and even have a whitelist of character sets! (Looking at you HDFC) - And of course, run of the mill spam They are all stuck in t…
Earlier quoted context omitted.
> cannot have more than 15 characters That's something! My bank insists on exactly 6 numbers. Not characters, numbers. They're also hostile to password managers and don't allow copy/paste. You have to click on the numbers with your mouse. "My security" is very important to them, so they've moved 2nd factor from a physical fob, to an app tied to my phone, and now they've improved it further by switching to sms! Now, t…
As I understand it, the thing with "click the number" codes is that it is a protection against keyloggers. The numbers are usually scrambled and when you click on it, you don't send the code but the position of the numbers you clicked. So for someone to get your code, you need both a screen capture and the position of mouse clicks. So 6 digits is low entropy, but it is compensated by a few layers of security. I don't…
Earlier quoted context omitted.
No it's not. Did you ever think that you can hash something twice? Hash it once on the client, then hash and salt it server side, like normal. It means that the server never actually knows your password, but that's about all it gives you.
> It means that the server never actually knows your password If the client is hashing it without a salt the server could simply check a Rainbow table ( https://en.wikipedia.org/wiki/Rainbow_table ) to know which password it is. For short inputs this could be trivial.
If the server is compromised in any way, passwords could be exfiltrated. Companies are, sometimes, wildly incompetent. Zoom historically stored private keys on the same server as their "encrypted" data. I would not be surprised if your password is just stored for "convenience" or some other bullshit reason and just waiting to be breached.